JWT Decoder & Encoder
Decode any JSON Web Token, inspect claims, verify HMAC signatures, and encode new tokens.
Frequently Asked Questions
Is the JWT decoder free?
Yes, completely free with no account or signup required.
Is my JWT token safe?
All decoding and encoding happens in your browser. Your token is never sent to any server.
What JWT features are included?
Decode a JWT to read its header and payload, verify HMAC signatures, encode a new JWT with a custom header, payload, and secret, and view expiry time.
Can I verify JWT signatures?
Yes. Enter your HMAC secret and the tool verifies whether the token signature is valid for the provided header and payload.
What is a JWT?
A JSON Web Token (JWT) is a compact, URL-safe token containing a signed JSON payload. It is widely used for authentication — a server issues a token that clients send with each request to prove identity.
How do I create a JWT token online?
Switch to the Encode tab, fill in the header (algorithm) and payload (claims) as JSON, enter your HMAC secret, and click Encode. The signed JWT is generated instantly.
What JWT algorithms are supported?
This tool supports HMAC-based algorithms: HS256, HS384, and HS512. These use a shared secret key to sign and verify tokens.
What is the difference between HS256 and RS256?
HS256 uses a shared HMAC secret — the same key signs and verifies the token. RS256 uses an RSA private key to sign and a public key to verify, so verification can be public without exposing the signing key.
What is the exp claim and how do I set it?
exp is the expiration timestamp in seconds since Unix epoch (1970-01-01). Add it to your payload as a number, e.g. 'exp': 1893456000. Tokens with an exp in the past are rejected.
What is the difference between JWT and session cookies?
Session cookies store a session ID server-side and require a database lookup. JWTs are stateless — the server validates them using a key with no storage lookup, making them ideal for distributed systems.
Can JWT be used for authorization?
Yes. After authentication, a server issues a JWT containing the user's roles or permissions. Every subsequent request includes the JWT so the server can authorize the action without a database query.